Heateor
11 CVEs across 8 Heateor products. Browse Heateor vulnerabilities, severities, and proof-of-concept exploits.
Heateor products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-9857 | Medium | 6.4 | 2025-09-10 | The Heateor Login – Social Login Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Heateor_Facebook_Login' shortcode i… |
CVE-2025-5528 | Medium | 6.1 | 2025-06-07 | The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the heateor_mastodon_share parameter in… |
CVE-2024-13230 | Medium | 5.3 | 2025-01-21 | The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to Limited SQL Injection via the ‘SuperSocializ… |
CVE-2023-41802 | Medium | 4.3 | 2024-12-13 | Missing Authorization vulnerability in Team Heateor Super Socializer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2024-11252 | Medium | 6.1 | 2024-11-30 | The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the heateor_mastodon_share parameter in… |
CVE-2024-9946 | High | 8.1 | 2024-11-06 | The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to authentication bypass in all versions up to… |
CVE-2024-10020 | High | 8.1 | 2024-11-06 | The Heateor Social Login WordPress plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.1.35. This is due to ins… |
CVE-2022-4971 | Medium | 6.1 | 2024-10-16 | The Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'urls' parameter called via the 'heateor_sss_sharing_count'… |
CVE-2024-4924 | Medium | 6.1 | 2024-06-12 | The Social Sharing Plugin WordPress plugin before 3.3.63 does not sanitise and escape some of its settings, which could allow high privilege users such as adm… |
CVE-2024-35706 | High | 7.1 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Team Heateor Heateor Social Login allows Cross-Sit… |
CVE-2024-35707 | Medium | 6.5 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Team Heateor Heateor Social Login allows Stored XS… |
CVE-2024-32674 | Medium | 5.4 | 2024-05-08 | Heateor Social Login WordPress prior to 1.1.32 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be ex… |
CVE-2024-2159 | Medium | 4.7 | 2024-04-26 | The Social Sharing Plugin WordPress plugin before 3.3.61 does not validate and escape some of its shortcode attributes before outputting them back in a page/p… |
CVE-2024-2836 | Medium | 4.8 | 2024-04-15 | The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.64 does not sanitise and escape some of its settings, which could allow… |
CVE-2024-29804 | Medium | 6.5 | 2024-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Team Heateor Fancy Comments WordPress allows Stored XSS.T… |
CVE-2024-1989 | Medium | 6.4 | 2024-03-06 | The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Sassy_Social_Share' shortcod… |
CVE-2024-1448 | Medium | 6.4 | 2024-02-29 | The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions… |
CVE-2024-24712 | Medium | 6.5 | 2024-02-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Team Heateor Heateor Social Login WordPress allows Stored… |
CVE-2023-35882 | Medium | 6.5 | 2023-06-20 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Team Heateor Super Socializer plugin <= 7.13.52 versions. |
CVE-2023-23977 | Medium | 6.5 | 2023-04-04 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Team Heateor WordPress Social Comments Plugin for Vkontakte Comments and Disqus Comment… |
CVE-2023-23670 | Medium | 6.5 | 2023-03-30 | Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Team Heateor Fancy Comments WordPress plugin <= 1.2.10 versions. |
CVE-2022-4484 | Medium | 5.4 | 2023-01-16 | The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.44 does not validate and escape some of its shortcode attributes before… |
CVE-2022-4451 | Medium | 5.4 | 2023-01-16 | The Social Sharing WordPress plugin before 3.3.45 does not validate and escape some of its shortcode attributes before outputting them back in the page, which… |
CVE-2021-24987 | Medium | 6.1 | 2022-04-11 | The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.30 does not sanitise and escape the urls parameter in its the_champ_shar… |
CVE-2021-24746 | Medium | 6.1 | 2022-03-28 | The Social Sharing Plugin WordPress plugin before 3.3.40 does not escape the viewed post URL before outputting it back in onclick attributes when the "Enable '… |
CVE-2021-39321 | High | 8.8 | 2021-10-21 | Version 3.3.23 of the Sassy Social Share WordPress plugin is vulnerable to PHP Object Injection via the wp_ajax_heateor_sss_import_config AJAX action due to de… |